CVE-2026-67226: RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag administrator. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.22 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.14 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated RabbitMQ administrator can exploit it. The affected operation is the management API user update path, and definition import can also be used to introduce the malicious tag list.
What does exploitation require?
The attacker needs to submit a very large list of unique user tags, on the order of roughly one million unique tags. A single request can crash the RabbitMQ node.
Which versions contain the fix?
The issue is fixed in RabbitMQ 4.0.22, 4.1.14, and 4.2.7. The affected versions begin with 4.0.0 and extend until those fixed releases.
What can be done before upgrading?
Restrict administrator access to the management API and prevent untrusted or unreviewed definition imports. Do not allow administrative users to create or update users with unusually large, unique tag lists.